640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535

Analysis

max time kernel
5s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:55

Sharing

Reason

platform exec: image=C:\Users\Admin\AppData\Local\Temp\640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535.exe command="C:\Users\Admin\AppData\Local\Temp\640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535.exe" wdir=C:\Users\Admin\AppData\Local\Temp Payload error: The %1 application cannot be run in Win32 mode.

Report Analysis Logs

General

Target

640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535.exe
Size

331KB
MD5

1c8f52e6a0f035b16d84b96f5e26fe30
SHA1

89891221726a43cdff30f819911907d62434b3c4
SHA256

640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535
SHA512

783a53bc2ab67e78b3f076778562b6de09cf9933be1ec94d1c642712528d31d4acf77fdd3755fd6c86d002762372448cc1b327570f6ee7bbb0459d33ae6aa30e
SSDEEP

6144:JHqEAKI2t+J3iYcBdbouZxLiBI3klNj2M3wOxbvJjh81+5PkO6ub:V3I2t+oYC040lNj2MAKBq1BxE

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5008-132-0x0000000000010000-0x0000000000062C80-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535.exe
"C:\Users\Admin\AppData\Local\Temp\640ccfad1b9af81db17da6ab419a03b1c737897de74e7bc675400e0f0d4c0535.exe"
1⤵
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-132-0x0000000000010000-0x0000000000062C80-memory.dmp

Filesize
331KB

Download